It is often an important goal for network security systems to be able to passively identify suspicious communications in a way that does not modify or disrupt the network. Typically, conventional passive network security systems, such as intrusion detection systems, rely on deep content inspection of packets to identify suspicious communications. Such approaches require deep knowledge, intricate parsing, and usually a library of signatures or heuristics for each type of suspicious activity that is to be identified. Often the library of signatures or heuristics can sprawl to 30,000 or more, which can make the use of such libraries unwieldy and/or computationally expensive. Furthermore, in some cases, deep content inspection may not be available due to restricted network permissions and/or the sensitivity of the data being transmitted. These requirements create an enormous burden on vendors seeking to create products that passively detect threats over a range of networking protocols.
As is evident, there is a need for an approach to passively identify suspicious communications or network threats without deep content inspection and/or sprawling signature libraries.